CVE-2026-109947

A flaw was found in FreeRDP. When a user connects to a malicious or compromised Remote Desktop Protocol (RDP) server with drive redirection enabled, the server can issue an oversized read request. Because incoming read request sizes are not properly bounded, the client attempts to allocate an excessively large memory buffer, leading to memory exhaustion and an application crash. This failure results in a Denial of Service (DoS) for the connecting user.

This flaw is rated Moderate because a malicious or compromised RDP server can crash the FreeRDP client when unbounded allocation / resource consumption is used, causing a denial of service for the connecting user. Exploitation requires the user to initiate a connection (UI:R). Confidentiality and integrity are not impacted. Red Hat platform safeguards such as ASLR, NX, and FORTIFY_SOURCE do not remove the crash impact, so Availability remains High.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.